CCPA / CPRA Compliance

# data_inventory.py — what personal data you collect, where, and who receives it
DATA_INVENTORY = {
    "users.email": {"category": "contact", "sensitive": False, "shared_with": ["SendGrid"]},
    "users.location": {"category": "location", "sensitive": True, "shared_with": []},
    "events.device_id": {"category": "identifier", "sensitive": False, "shared_with": ["Mixpanel"]},
}

// Express.js middleware — detect GPC signal and honor opt-out
const gpcMiddleware = (req, res, next) => {
  const gpcEnabled = req.headers['sec-gpc'] === '1';

  if (gpcEnabled) {
    // Auto-apply opt-out for this request
    req.privacyConsent = {
      optedOutOfSale: true,
      optedOutOfSharing: true,
      source: 'gpc_signal',
      detectedAt: new Date().toISOString()
    };
  
    // Record opt-out preference
    if (req.user) {
      recordOptOut(req.user.id, 'gpc_signal');
    } else {
      // Use cookie to persist for anonymous users
      res.cookie('ccpa_optout', '1', { 
        maxAge: 365 * 24 * 60 * 60 * 1000,  // 1 year
        httpOnly: true, 
        secure: true, 
        sameSite: 'Lax'
      });
    }
  }

  next();
};

# FastAPI DSR endpoints
from fastapi import FastAPI, BackgroundTasks, HTTPException
from pydantic import BaseModel, EmailStr
from enum import Enum
import uuid
from datetime import datetime, timezone

app = FastAPI()

class DSRType(str, Enum):
    KNOW = "know"
    DELETE = "delete"
    CORRECT = "correct"
    OPT_OUT = "opt_out"
    LIMIT_SPI = "limit_sensitive"
    PORTABILITY = "portability"

class DSRRequest(BaseModel):
    request_type: DSRType
    email: EmailStr
    name: str
    correction_details: str | None = None  # For CORRECT requests

class DSRResponse(BaseModel):
    request_id: str
    status: str
    deadline: str
    message: str

@app.post("/api/privacy/dsr", response_model=DSRResponse)
async def submit_dsr(request: DSRRequest, background_tasks: BackgroundTasks):
    """Submit a Data Subject Request."""
    request_id = str(uuid.uuid4())
    deadline_days = 15 if request.request_type in (DSRType.OPT_OUT, DSRType.LIMIT_SPI) else 45  # 15 business days vs 45 calendar days
  
    # Store request
    dsr_record = {
        "id": request_id,
        "type": request.request_type,
        "email": request.email,
        "name": request.name,
        "status": "pending",
        "submitted_at": datetime.now(timezone.utc).isoformat(),
        "deadline_days": deadline_days,
        "verified": False
    }
    await db.dsr_requests.insert(dsr_record)
  
    # Opt-out and limit requests must NOT require verification: process them now.
    if request.request_type in (DSRType.OPT_OUT, DSRType.LIMIT_SPI):
        background_tasks.add_task(process_dsr, request_id, request.request_type, request.email)
        return DSRResponse(request_id=request_id, status="processing",
                           deadline="15 business days at most",
                           message="Your request is being applied.")

    # Others: confirm receipt within 10 business days and verify identity.
    # send_verification_email must create and store a one-time token on the record.
    background_tasks.add_task(send_verification_email, request.email, request_id)
    return DSRResponse(
        request_id=request_id,
        status="pending_verification",
        deadline="45 days from receipt (verification time counts)",
        message="We've sent a verification email. Please verify your identity to proceed."
    )

@app.post("/api/privacy/dsr/{request_id}/verify")
async def verify_dsr(request_id: str, token: str, background_tasks: BackgroundTasks):
    """Verify identity and begin DSR processing."""
    dsr = await db.dsr_requests.find_one({"id": request_id, "token": token})
    if not dsr:
        raise HTTPException(status_code=404, detail="Request not found")
  
    await db.dsr_requests.update({"id": request_id}, {"verified": True, "verified_at": datetime.now(timezone.utc).isoformat()})
    background_tasks.add_task(process_dsr, request_id, dsr["type"], dsr["email"])
  
    return {"status": "processing", "message": "Identity verified. Processing your request."}

async def process_dsr(request_id: str, dsr_type: DSRType, email: str):
    """Process DSR by type."""
    user = await db.users.find_one({"email": email})
    if not user:
        await complete_dsr(request_id, "no_data_found")
        return
  
    if dsr_type == DSRType.DELETE:
        await delete_user_data(user["id"])
    elif dsr_type == DSRType.KNOW:
        data_export = await export_user_data(user["id"])
        await send_data_export(email, data_export)
    elif dsr_type in (DSRType.OPT_OUT, DSRType.LIMIT_SPI):
        await opt_out_user(user["id"])  # LIMIT_SPI also needs its own flag for sensitive data
    elif dsr_type == DSRType.CORRECT:
        await queue_correction_review(request_id, user["id"])  # applies correction_details after review
        return  # not complete until the correction is applied
    elif dsr_type == DSRType.PORTABILITY:
        portable_data = await export_portable_data(user["id"])
        await send_data_export(email, portable_data, format="json")
  
    await complete_dsr(request_id, "completed")

async def export_user_data(user_id: str) -> dict:
    user = await db.users.find_one({"id": user_id})
    orders = await db.orders.find({"user_id": user_id})
    return {
        "export_date": datetime.now(timezone.utc).isoformat(),
        "profile": {"name": user["name"], "email": user["email"], "created_at": user["created_at"]},
        "purchase_history": [{"order_id": o["id"], "date": o["date"], "amount": o["amount"]} for o in orders],
        "third_party_sharing": [{"vendor": "Stripe", "purpose": "Payment processing"}],
    }

// Track and honor opt-out preference
async function recordOptOut(userId, source) {
  await db.privacyPreferences.upsert({
    userId,
    optedOutOfSale: true,
    optedOutOfSharing: true,
    source,  // 'user_request' | 'gpc_signal' | 'cookie_banner'
    timestamp: new Date().toISOString()
  });

  // Propagate to every vendor that receives data for advertising or analytics.
  // Use each vendor's own suppression/opt-out API and also stop loading their tags
  // for this visitor; check the vendor docs, the calls differ per product.
  await stopSharingWithVendors(userId);
}